Towards Effective Network Intrusion Detection: A Hybrid Model Integrating Gini Index and GBDT with PSO

Li, Longjie; Yu, Yang; Bai, Shenshen; Cheng, Jianjun; Chen, Xiaoyun

doi:10.1155/2018/1578314

Cited by 44 publications

(35 citation statements)

References 46 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As mentioned earlier, an accurate data-driven diagnostics scheme requires optimal feature selection as it affects the accuracy of the classifier. In a broader context, the use of filter and wrapper feature selection methods for diagnosis spans beyond hydraulic pumps to rolling bearings diagnostics/prognostics [34], gear fault detection [35], wireless sensor network intrusion [36], sentiment classification [37], etc. Wrapper methods (and global search algorithms) are efficient for discovering global solutions to variant problems while most filter methods are faced with diverse issues of instability [38]; nevertheless, as a pre-processing technique, these filter methods-Pearson's correlation, chi-square, linear discriminant analysis, etc.…”

Section: B Meta-heuristic Methods For Feature Selectionmentioning

confidence: 99%

“…On the other hand, several meta-heuristic feature selection techniques have been proposed in the past including the PSO, Genetic Algorithm, Ant Colony Optimization, scalability, Simulated Annealing, and other embedded methods. Compared with other metaheuristic algorithms PSO has the advantages of ease-of-use, speed, better representation, local minima avoidance, and its primary strength-the capability of global search optimization [18], [36].…”

Section: B Meta-heuristic Methods For Feature Selectionmentioning

confidence: 99%

See 1 more Smart Citation

A Multi-Domain Diagnostics Approach for Solenoid Pumps Based on Discriminative Features

Akpudo

Hur

2020

IEEE Access

View full text Add to dashboard Cite

Accurate condition monitoring of industrial cyber-physical systems/components demands the use of reliable fault detection and isolation (FD&I) methodologies. Meta-heuristic algorithms for feature selection have good exploration capability for optimal discriminative feature selection for fault isolation/classification of which the Binary Particle swarm optimization (BPSO) is superior to its counterparts. This study presents a robust approach for vibration-based failure diagnostics of electromagnetic/solenoid pumps which employ a multi-domain feature extraction procedure (statistical time-domain and frequencydomain features, Mel frequency cepstral coefficients, and continuous wavelet coefficients) for capturing linear and nonlinear properties from the signals. Compared with other filter and wrapper methods for supervised feature selection, a hybrid filter-wrapper (Pearson's correlation-BPSO (ρ-BPSO)) feature selection procedure is proposed for global search of optimal discriminative (uncorrelated) features for fault diagnosis with an RBF-kernel support vector machine (SVM*). Subsequently, a practical case study involving five VSC63A5 solenoid pumps at various operating/fault conditions is presented for validating the performance of the proposed approach. Results show the superior performance of the proposed hybrid filterwrapper approach against filter-based and wrapper-based techniques for discriminative feature selection. Also, the proposed ρ-BPSO-SVM* diagnostics model performance was compared with other standard fault isolation/classification methods.

show abstract

Section: B Meta-heuristic Methods For Feature Selectionmentioning

confidence: 99%

Section: B Meta-heuristic Methods For Feature Selectionmentioning

confidence: 99%

A Multi-Domain Diagnostics Approach for Solenoid Pumps Based on Discriminative Features

Akpudo

Hur

2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…And in the second stage, a BP network is used to identify attack categories in abnormal. Li et al [35] proposed a model combining a Gini index and gradient boosting decision tree (GBDT) with particle swarm optimization (PSO). The optimal feature subset is selected by the Gini index, and the network attack is detected by a gradient lifting decision tree algorithm.…”

Section: Related Workmentioning

confidence: 99%

“…GINI-GBDTPSO [35] 86.10 CNN [43] 79.48 LSTM [44] 92.00 DMNB [45] 96.50 DBN-SVM [46] 92.84 TUIDS [47] 96.55 RNN-IDS [48] 81.29 Our Proposed IDS 99.529 From Tables 4 and 5, our proposed IDS (i.e., the IDS based on the S-ResNet) has higher accuracy than the other IDSs on the NSL-KDD dataset, and higher recall than the other IDSs for each category on the NSL-KDD dataset, especially for R2L and U2R attacks.…”

Section: Idss Accuracy (%)mentioning

confidence: 99%

An Intrusion Detection System Based on a Simplified Residual Network

Xiao

2019

Information

View full text Add to dashboard Cite

Residual networks (ResNets) are prone to over-fitting for low-dimensional and small-scale datasets. And the existing intrusion detection systems (IDSs) fail to provide better performance, especially for remote-to-local (R2L) and user-to-root (U2R) attacks. To overcome these problems, a simplified residual network (S-ResNet) is proposed in this paper, which consists of several cascaded, simplified residual blocks. Compared with the original residual block, the simplified residual block deletes a weight layer and two batch normalization (BN) layers, adds a pooling layer, and replaces the rectified linear unit (ReLU) function with the parametric rectified linear unit (PReLU) function. Based on the S-ResNet, a novel IDS was proposed in this paper, which includes a data preprocessing module, a random oversampling module, a S-Resnet layer, a full connection layer and a Softmax layer. The experimental results on the NSL-KDD dataset show that the IDS based on the S-ResNet has a higher accuracy, recall and F1-score than the equal scale ResNet-based IDS, especially for R2L and U2R attacks. And the former has faster convergence velocity than the latter. It proves that the S-ResNet reduces the complexity of the network and effectively prevents over-fitting; thus, it is more suitable for low-dimensional and small-scale datasets than ResNet. Furthermore, the experimental results on the NSL-KDD datasets also show that the IDS based on the S-ResNet achieves better performance in terms of accuracy and recall compared to the existing IDSs, especially for R2L and U2R attacks.

show abstract

“…The experiment is conducted in a PC equipped with an Intel G2020 CPU, 8GB RAM, and a Windows 7 operating system. The algorithms commonly used in the domain of intrusion detection are K-Nearest Neighbor (KNN) [33], support vector machine (SVM) [34], Gradient Boosting Decision Tree (GBDT) [35], etc. Their execution effects based on the KDD99 dataset in intrusion detection are shown in Table 4.…”

Section: The Effect Of Classical Classifiers In Intrusion Detectionmentioning

confidence: 99%

Network Intrusion Detection Method Based on PCA and Bayes Algorithm

Zhang

Liu

Jia

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Intrusion detection refers to monitoring network data information, quickly detecting intrusion behavior, can avoid the harm caused by intrusion to a certain extent. Traditional intrusion detection methods are mainly focused on rule files and data mining. They have the disadvantage of not being able to detect new types of attacks and have the slow detection speed. To address these issues, an intrusion detection method based on improved PCA combined with Gaussian Naive Bayes was proposed. By weighting the first few feature vectors of the traditional PCA, data pollution can be reduced. The number of final weighted principal components is 2 through sequential selection. The dimensionality reduction of the data is achieved through improved PCA. Finally, the intrusion behaviors were detected by using the Gaussian Naive Bayes classifier. The indexes of detection accuracy, detection time, precision rate, and recall rate were applied to evaluate the results. The experimental results show that, comparing with the traditional Bayes method, the method proposed in this article can reduce the detection time by 60%, shorten it to 0.5s, and increase the detection rate to 91.06%. The mean value of detection accuracy is about 86% by cross-validation.

show abstract

Towards Effective Network Intrusion Detection: A Hybrid Model Integrating Gini Index and GBDT with PSO

Cited by 44 publications

References 46 publications

A Multi-Domain Diagnostics Approach for Solenoid Pumps Based on Discriminative Features

A Multi-Domain Diagnostics Approach for Solenoid Pumps Based on Discriminative Features

An Intrusion Detection System Based on a Simplified Residual Network

Network Intrusion Detection Method Based on PCA and Bayes Algorithm

Contact Info

Product

Resources

About